1. Field of the Invention
The present invention relates generally to computer security, and more particularly but not exclusively to methods and apparatus for detecting software robots in client computers.
2. Description of the Background Art
Software robots, which are commonly referred to as “bots,” are stealthy, unauthorized software programs running quietly in user computers. A bot can receive and execute instructions from a remote server computer operated by the bot's originator, which is also referred to as a “bot herder.” A bot may also be pre-programmed to perform a function without additional instructions from a bot herder. A network of computers taken over by related bots is called a “botnet.” A bot may be configured to use the infected computer, referred to as a “zombie,” to perform malicious online activities including to send spam e-mails or to host a malicious website. For example, a bot may use the zombie computer to host a website to perpetrate phishing or other cyber crimes. Computers can be infected by bots via several different methods including virus infection, drive-by-web-downloads and spyware downloaders that install other software onto a computer. Most users don't even know their computers have been infected and become part of a botnet.